Subject: RE: [mobile-ip] Mobile IPv6 - Issue 72 (Forwarding from previous CoA)

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Mon, 16 Sep 2002 20:16:05 +0200

> in section 8.3 of MIPv6 spec we have a list of shoulds 
  > against  "all IPv6 routers". Further we say in section 10.2
  > 
  >       " If the node is not a router that implements home agent
  >        functionality, then the node MUST reject the Binding Update
  >        and MUST return a Binding Acknowledgement to the mobile node,
  >        in which the Status field is set to 132 (home 
  > registration not
  >        supported). "
  > 
  > So there are already recommendations for all routers. 
  > 
  > There seems to be a number of ways to interpret the text. 
  > Mine is that that BUs are sent to CNs and Home Agents, not 
  > to (access)routers. I agree that this mentioned in the 
  > context of handovers but so are all the other BUs, even the 
  > BU to set up the primary care-of address registration to 
  > the Home Agent. At least I fail to see the difference.

=> The main problem here is how to setup security
with random ARs. This is _not_ the same as a HA
where there is a strong assumption that most of 
the time manual config will be used. This is 
why the issue needs to be investigated in a lot
more detail than the MIPv6 spec can do now given 
the time limitations and difficulty of the problem.
Using manual config with random ARs is not
going to be useful in most deployment cases. 

Hesham

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 16 Sep 2002 11:27:27 -0700

Hello Hesham,

It's not the job of the base Mobile IP specification to
describe how that security association would be established.

> the time manual config will be used.

That's not an assumption I have ever made.
I have typically assumed that there would be
other methods, compatible with the Mobile IP
requirements, but non-manual methods, for
creating the association.

I think it's a mistake to require that every
possible security application related to Mobile
IP has to be put in the Mobile IP specification.
I think the specification should be limited to
what to do with Binding Updates.

>                                        This is

Again, I don't think that your constraint should
affect the underlying feature description.

Regards,
Charlie P.

---

From: "James Kempf" <[email-masked]>
Date: Mon, 16 Sep 2002 15:01:09 -0700

Hi Charlie,

> describe how that security association would be established.

Unfortunately, it is.

I think the IESG is no longer allowing the IPsec "pixie dust" approach, where a
spec says that "IPsec shall be used" without specifying how it will be used. So
if FoPCoA is put into the spec, then we will have to state how the IPsec
security association is set up. Thomas and Erik can correct me if I am wrong.

> what to do with Binding Updates.

I agree. I also think it it is a mistake to try to put all possible
optimizations into the base spec. The fast handoff draft seems like a good place
where we can move the functionality.

            jak

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 16 Sep 2002 15:24:05 -0700

Hello Jim,

>> describe how that security association would be established.

That cannot be.  All the Mobile IP spec should say is how
the Binding Update needs to be authenticated.  Pytting all
security establishments into the base specification is
clearly un-doable.  By now, I think it's obvious that the
return routability should have been in another specification,
as I suggested two years ago.  But I am in no way suggesting
that we do so now.  I want to get this revised draft to the
IESG as soon as possible.

> I think the IESG is no longer allowing the IPsec "pixie dust" approach,

You are setting up a straw man beside me and knocking
that over.  I didn't say IPsec at all.  Labeling my
point as the "pixie dust" approach is missing my point
and trivializing it as that other straw man.

> where we can move the functionality.

The fast handoff draft has other functionality.
The discussion in the base specification says
how to use the Binding Update.

Regards,
Charlie P.